Skip to main content
Leadping uses the Standard Webhooks specification to sign automation webhook deliveries. This means your endpoint can use an existing Standard Webhooks-compatible library to verify that a request came from Leadping and was not changed in transit; you do not need a Leadping-specific verifier. Signature validation is optional. To use it, configure the Leadping Webhooks connection with the signature authentication mode and a signing secret in this format:
The decoded secret must be between 24 and 64 bytes. Store it in your secret manager and do not include it in source code, logs, URLs, or webhook payloads. When another authentication mode is selected, such as bearer, header, or none, Leadping does not add the signature headers described on this page.

​
Signature headers

Signed deliveries follow the Standard Webhooks signing format: Leadping calculates each v1 signature with HMAC-SHA256 over:
The signing key is the Base64-decoded portion of the whsec_ secret.

​
Validation steps

Validate a signed request before parsing or otherwise processing its body:
  1. Read the three signature headers.
  2. Reject a timestamp outside a short tolerance, such as five minutes.
  3. Build the signed content from the header values and the exact raw request-body bytes.
  4. Base64-decode the key after removing the whsec_ prefix.
  5. Calculate HMAC-SHA256 and compare it with every supported v1 signature using a constant-time comparison.
  6. Reject the request unless at least one signature matches.
  7. Deduplicate successful deliveries by webhook-id before performing side effects.
Do not deserialize the JSON and serialize it again before validation. Changes to whitespace, escaping, property order, or character encoding produce a different signature.

​
Use a Standard Webhooks library

The Standard Webhooks project maintains reference verification libraries with installation instructions and code samples for C#, JavaScript and TypeScript, Python, Java and Kotlin, Go, PHP, Ruby, Rust, and Elixir: Use the symmetric HMAC-SHA256 verifier from the library for your language. Pass it:
  • The whsec_ signing secret configured in Leadping
  • The exact, unmodified request body
  • The webhook-id, webhook-timestamp, and webhook-signature headers
The library should perform the HMAC comparison and timestamp validation. Configure a short timestamp tolerance, such as five minutes, when the library exposes that option. Return 401 Unauthorized or 400 Bad Request without processing the payload when verification fails. Return a successful 2xx response only after the delivery has been accepted for processing.

​
Retries and replay protection

Leadping may retry a webhook when an attempt fails. Retries keep the same webhook-id, but each attempt receives a current webhook-timestamp and a new signature. Store successfully processed webhook-id values for an appropriate period and make processing idempotent. Timestamp validation limits how long a captured request can be replayed; deduplication prevents a valid retry from applying the same operation twice. The Standard Webhooks format allows multiple space-separated signatures. Check every supported v1 entry and ignore signature versions your endpoint does not support.
Last updated: July 27, 2026